Daily Tech Digest - December 21, 2018

GDPR: EU Sees More Data Breach Reports, Privacy Complaints
The number of data breach reports filed since GDPR went into effect has hit about 3,500 in Ireland, over 4,600 in Germany, 6,000 in France and 8,000 in the U.K. GDPR also gives Europeans the ability to file class-action lawsuits against breached organizations, and some law firms have already been exploring these types of actions. And under article 77 of GDPR - "Right to complain to a supervisory authority" - Europeans can also file complaints with regulators about organizations' data protection practices, as they were also able to do before enactment of the new regulation. Regulators say these complaints have also been increasing. Numerous national data protection authorities say they have seen an increase in both complaints as well as breach reports. But as information security expert Brian Honan has told Information Security Media Group, the increase in data breach reports does not mean there has been a surge in data breaches


Everything you need to know about the CDO explained

Because the role is so reliant on the use of technology, there is an overlap with the CIO position -- and there's some competition as a result, says Ellis. Yet rather than being experts in IT implementation, CDOs are commonly characterised as change agents. "Where CDOs can be very effective, and can initiate new approaches quickly, is where they buy cloud services and avoid in-house IT development in a traditional sense," says Ellis. "CIOs remain the owners of the technology infrastructure of any company." CDOs tend to be strong communicators. They talk about the power of disruption and get people to buy into change. Darren Curry, CDO at NHS Business Services Authority, says the role is about more than implementing digital services. "I support people, identify a vision and enable our people to do their very best," he says. "I see myself as leader who removes the blockers and barriers to allow our people to achieve their aims for our services. That's what I feel any leader -- whether that's a CDO or another senior role -- should be working to achieve."


Want to use AI and machine learning? You need the right infrastructure
Regardless of use case, AI/ML success depends on making the right infrastructure choice, which requires understanding the role of data. AI and ML success is largely based on the quality of data fed into the systems. There’s an axiom in the AI industry stating that “bad data leads to bad inferences”— meaning businesses should pay particular attention to how they manage their data. One could extend the axiom to “good data leads to good inferences,” highlighting the need for the right type of infrastructure to ensure the data is “good.” Data plays a key role in every use case of AI, although the type of data used can vary. For example, innovation can be fueled by having machine learning find insights in the large data lakes being generated by businesses. In fact, it’s possible for businesses to cultivate new thinking inside their organization based on data sciences. The key is to understand the role data plays at every step in the AI/ML workflow.


The Role Of Data Governance In An Effective Compliance Program

Data governance becomes more important the more systems and applications a compliance function uses. Compliance officers want systems that store data in a single repository with standardized data formats because strong data governance ensures accurate reports. From there, compliance officers can make accurate decisions based on what the data tells them. Here’s the rub: The current landscape of compliance technology is composed of many disparate systems that don’t integrate with each other. Compliance officers are often stuck searching for critical data and don’t have a connected approach to the technology that supports their program. They want and need a system that stores data in a single repository with standardized data. How can data governance fix this problem? Automating a compliance program’s many tasks helps to create a unified operations environment. In this paradigm, the compliance function goes beyond its tasks of third-party due diligence and training. 


Scaling Observability at Uber

Srivatsan states that "high cardinality has always been the biggest challenge for our alerting platform." As Aaron Sun writes, "cardinality in the context of monitoring systems is defined as the number of unique metric time series stored in your system's time series database." Originally, Uber handled their high cardinality by having alert queries return multiple series and having rules that trigger only if enough series crossed a threshold. This worked well with queries that returned a bounded number of series with well-defined dependencies. However, once teams started writing queries to alert on a per city, per product, and per app version to support their new product lines, the queries no longer fit this constraint. The team began leveraging Origami to help with these more complicated queries. As noted above, Origami is capable of deduplication and rollup of alerts. It is also capable of creating alerts on combinations of city, product, and app version which are then triggered on aggregate policies.


5 steps to getting started with robotic process automation

At the extremes, some businesses go big and “all in” right away, while others are more measured with an individual use case to provide proof points before further deployment. Many others take a hybrid approach that lies somewhere in between. Getting started with RPA may look different from business to business, but designing a proof-of-concept project is often the best way to jumpstart RPA efforts in your organization. Depending on the structure of your organization, change may not always come swiftly. Executives need proof points when making major decisions such as augmenting or flat-out reimagining long-standing processes. When it comes to RPA, using these five steps to assess your organization's processes and determine which would make for a high-impact proof of concept will set you up for both short- and long-term automation success. And remember — it’s not about replacing jobs. It’s more about handling mundane or time-consuming tasks in a more efficient manner to enable your teams to spend more time concentrating on meaningful work.


Hackers Bypass Gmail, Yahoo 2FA at Scale

Amnesty discovered several credential phishing campaigns, likely run by the same attacker, targeting hundreds of individuals across the Middle East and North Africa. One campaign went after Tutanota and ProtonMail accounts; another hit hundreds of Google and Yahoo users. The latter was a targeted phishing campaign designed to steal text-based second-factor codes. Throughout 2017 and 2018, human rights defenders (HRDs) and journalists from the Middle East and North Africa shared suspicious emails with Amnesty, which reports most of this campaign's targets seem to come from the United Arab Emirates, Yemen, Egypt, and Palestine. Most targets initially receive a fake security alert warning them of potential account compromise and instructing them to change their password. It's a simple scheme but effective with HRDs, who have to be on constant high alert for physical and digital security. From there, targets are sent to a convincing but fake Google or Yahoo site to enter their credentials; then they are redirected to a page where they learn they've been sent a two-step verification code.


FBI kicks some of the worst ‘DDoS for hire’ sites off the internet

US-JUSTICE-POLITICS-COMPUTERS
Several seizure warrants granted by a California federal judge went into effect Thursday, removing several of these “booter” or “stresser” sites off the internet “as part of coordinated law enforcement action taken against illegal DDoS-for-hire services.” The orders were granted under federal seizure laws, and the domains were replaced with a federal notice. Prosecutors have charged three men, Matthew Gatrel and Juan Martinez in California and David Bukoski in Alaska, with operating the sites, according to affidavits filed in three U.S. federal courts, which were unsealed Thursday. “DDoS for hire services such as these pose a significant national threat,” U.S. Attorney Bryan Schroder said in a statement. “Coordinated investigations and prosecutions such as these demonstrate the importance of cross-District collaboration and coordination with public sector partners.” The FBI had assistance from the U.K.’s National Crime Agency and the Dutch national police, and the Justice Department named several companies, including Cloudflare, Flashpoint and Google, for providing authorities with additional assistance.


Connecting Business Challenges and Emerging Technologies

Robotic Process Automation (RPA) can be used to automate tasks previously done by human beings, said O’Carroll. It is often applied to repetitive and mundane tasks – the ones often seen as boring. With RPA you can have a robot doing it for you, she said. Solutions based on RPA technology have decisions built in which enable you to do creative work. She explained how you could train a robot to do purchase orders by building rules to extract information from an email, enter the information into the purchase order system, and generate the purchase order. O’Carroll mentioned use cases for RPA: case management (for instance in healthcare), HR for administrating joiners, movers, people leaving, and banks. It can be cheaper to do these activities with robots, and automation can give people more time to spend with customers, she argued. Machine learning (ML) and artificial intelligence (AI) are a different kind of technology as they are based on how our brain works with neural networks, said O’Carroll. It’s about predicting the right answer and getting better at it.


How AI-powered commerce will change shopping

If you think AI is over-hyped from a commerce point of view, think again. Research shows that customers are 9.5X more likely to view AI as revolutionary versus insignificant. Within the next five years, 87 percent of customers believe AI will have transformed their expectations of companies. But how, exactly, is AI changing expectations? While pop culture sometimes paints AI with a scary science-fiction hue, the truth is that many AI-driven experiences are winning customer appreciation, if not affection. A majority of customers say they like or love AI-powered capabilities like credit card fraud detection, personalized recommendations, and voice-activated personal assistants. And today, "personalized recommendations" doesn't mean merely adding an individual's name to an email subject line. We're talking about uber-personalized communications; 59 percent of customers say tailored engagement based on past interactions is very important to winning their business.



Quote for the day:


"Leaders think and talk about the solutions. Followers think and talk about the problems." -- Brian Tracy


Daily Tech Digest - December 20, 2018

Industrial IoT, fog-networking groups merge to gain influence

4 industrial iot robotics automation manufacturing code
“By expanding our pool of resources and expert collaborators, we will continue to accelerate the adoption of not only fog, but a wealth of technologies that provide the underpinnings to IoT, AI and 5G,” wrote Matt Vasey, chairman and president, OpenFog Consortium, in a blog about the merger. “Machines, things, and devices are becoming increasingly intelligent, seamlessly connected, and capable of massive storage with the ability to be autonomous and self-aware. Robots, drones and self-driving cars are early indicators of small and mobile clouds. Distributed intelligence that interacts directly with the world and is immersive with all aspects of their surrounding is the concept behind fog,” he said. Merging the two groups is a natural fit and helps consolidate an overly fragmented collection of groups striving to create standards in the large IoT market, said Christian Renaud, research vice president, internet of things, 451 Research, in a blog about the unification.



RaptorDB - The Document Store

xxxxxxxxxxx
The main driving force behind the development of RaptorDB is making the developer's and support jobs easier, developing software products is hard enough without complete requirements which becomes even harder when requirements and minds change as they only do in the real world. ... Document databases or stores are a class of storage systems which save the whole object hierarchy to disk and retrieve the same without the use of relational tables. To aid the searching in such databases most Document store databases have a map function which extracts the data needed and saves that as a "view" for later browsing and searching. These databases do away with the notion of transactions and locking mechanism in the traditional sense and offer high data through-put and "eventually consistent" data views. This means that the save pipeline is not blocked for insert operations and reading data will eventually reflect the inserts done ( allowing the mapping functions and indexers time to work).


How to Make Cross-Functional Operations a Team Effort

Cross-functional collaboration, if done right, can make a company leaner and more innovative from the ground-up by reducing groupthink, because all decisions are taken through a cooperative and creative process with singular focus on the achievement of each organizational goal. Data supports this observation. A study of over 1100 companies shows that companies that embraced collaborative working are five times as likely to be high performing than those that don’t. If cross-functional teams are so awesome, why don’t we see more of them? Because they’re devilishly hard to manage and steer towards delivering real results, that’s why. Behnam Tabrizi, who teaches transformational leadership at Stanford University, reveals a shocking insight from his research– nearly 75% of cross-functional teams are dysfunctional! So we have two facts that are equally compelling. First, well-oiled cross-functional teams are exponentially more successful than “regular” teams. Second, getting a cross-functional team to perform to their potential is hard, but definitely not impossible.


Mobile security needs a rethink for the 5G era


“We are expecting the first 5G enabled services to come to market next year and we are already doing significant work across the UK test beds,” said Rahim Tafazolli, University of Surrey Regius professor and founding director of the 5GIC. “The benefits of being prepared for what 5G offers are clear for all to see. “Performance risk in such a complex network means that we need to reconsider many of our digital security processes. We believe that with the sound recommendations made in this paper, the UK will be in a good position to continue our leadership position in 5G innovation, development and deployment.” Peter Claydon, project director of AutoAir, said: “Since the age of 2G, mobile networks have been some of the most secure things on the planet, helped by the fact that each one is controlled by a single network operator. 5G opens up mobile networks, allowing network operators to provide ‘slices’ of their networks to customers.


Top smart city predictions for 2019

smart cities
It will be a breakthrough year. We will see a move from pilots/proof of concepts to at-scale implementations. As with any first wave of adoption, this will result in exciting breakthroughs and early learnings. There will be citizen impact; in general, citizens will be more engaged and will push city leaders for impact. Millennials and social media will play a more vocal role in the smart cities conversations and start influencing electability. Equitable access and growth will be a key focus. The focus will move from an umbrella conversation to the top specific use cases: public safety, transportation, resilience and sustainability, and new business models. Infrastructure with vision/sensing capabilities will become real. Teamwork makes the dream work. A global fraternity of cities will start manifesting itself. We will see a much greater trend of cities reaching out and sharing key learnings. The cross-pollination of human talent between public and private sector as it relates to smart cities will be visible. This will help accelerate the overall adoption.


Chinese hackers tap into EU diplomatic communications network

An assessment of Chinese military capabilities conducted by the US Department of Defense (DoD) suggested that the country "saw cyber operations as a low-cost deterrent that can demonstrate capabilities and challenge an adversary." Deterrent it may be, but China has been accused of being behind a range of cyber assaults for years. The US has charged a number of hackers for allegedly belonging to the PLA and conducting cyberattacks of political interest on the unit's behalf. Despite an agreement forged between the US and China in 2015, US government officials warned this year that Chinese hacking activity has increased. Chinese officials have always denied such allegations. The researchers say that the threat actors responsible were able to compromise the network via a successful phishing campaign. However, the team also claims that the attack is part of a larger scheme which has also targeted the United Nations and the American Federation of Labor and Congress of Industrial Organization


Security Architecture for Smart Factories

security architecture for smart factories
Smart factory operations are data-driven. The abundance of data a smart factory harnesses can include the amount of raw materials it has in storage, the production speeds of its machines, the location of ongoing deliveries, and a great deal more, depending on its industry. Big data allows the smart factory to paint a virtual copy of physical operations that is used to carry out functions such as predicting outcomes and making autonomous decisions. Organizations should be prepared for the vast amount of data this entails. They should be able to identify the types of data to be used and map out its course from collection and transfer to processing and storage. Mapping also means noting all possible exit and entry points. Personnel, for example, can move information from the office to the factory using external storage devices like USB flash drives. Terminals can also be taken in and out of factories for servicing. Aside from setting security protocols for personnel in handling such scenarios, tools should also be used to make sure that these portable devices are clean and virus-free before being connected or reconnected to the factory’s systems.


What Is Shadow DOM, and How Do You Use It?

Shadow DOM may have a name that conjures images of a dark world. But it’s actually a pretty neat feature of modern browsers, allowing for easy encapsulation of DOM elements and smart web components. If you‘re a front-end developer, you’ll likely benefit from understanding how Shadow DOM works and what it can do for you. That’s what this article explains. Keep reading for an introduction to Shadow DOM. ... One interesting thing to note is that, while JavaScript events are retargeted to the parent element in order to avoid exposing access to the internal Shadow DOM elements, these same elements can be interacted with using CSS as long as you know what the elements are and how to access them. But, as cool as it is, how can we best utilize the ... Because none of the code inside a Shadow DOM element can affect anything outside of it, the Shadow DOM is an excellent tool for encapsulation. In some circumstances, obscuring elements may be used as well; however, this method is hardly fool proof, so you are better off reaping the benefits of the encapsulation and management features instead.


Threat Hunting for the Holidays


How will you know for sure if a threat has evaded detection and is now inside your network? Yes, you can scour through every piece of research available about the threat. You can then comb through stacks of network logs across your environment to find anomalies and suspicious behavior. But won’t it take you days or weeks to find out how the threat got in, all the places it has been, and everything it did? And, will your boss have the patience to wait for your definitive response? There’s a better way. Cisco helps boost your ability to conduct threat hunting and incident response activities with a set of integrated tools that allows you to proactively search for threats and understand the full scope of a compromise. And upon seeing a threat in one place, Cisco gives you the ability to automatically block it everywhere else. As part of this integrated security architecture, Cisco Threat Response speeds threat hunting by gathering, combining, and correlating threat intelligence available from: 1) your recorded network and security data, 2) Cisco Talos, 3) other Cisco products, and 4) third-party solutions.


The Manual Regression Testing Manifesto

The manual regression testing manifesto provides a couple of things. First, it helps define a clear line differentiating feature testing from regression testing, a difference that is often a challenge for testers and management. Each core principle in the manifesto focuses on two elements that both have value in testing. By contrasting their relative value, we define expectations for testing throughout the release cycle. It’s not that one is bad and the other good, it’s that there is a time a place for each and testers need to be able to speak to that difference. Second, it provides a framework to start discussing quality and how testers contribute to it. It’s easy for people to typecast testers as nefarious breakers of software, when in reality we probably love the software we are testing as much or more than the developers writing it. We don’t have the bond of the creator yet we spend countless hours working with it just trying to ensure its success. Teams spend a great deal of time discussing coding standards and practices, but code is much more tangible and measurable than testing and quality.



Quote for the day:


"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor


Daily Tech Digest - December 19, 2018


For tech companies, the worst-case no-deal Brexit could see data flows between the UK and Europe cut or significantly curtailed, major difficulties with recruiting staff from Europe and sending staff to Europe to work on projects, problems with importing products and spare parts, plus a generally worsening economic situation. In fact, the impact of a potential no-deal Brexit is already being felt. Larger tech companies are spending a lot of time figuring out their response to Brexit and are putting in place or triggering various contingency measures. Meanwhile, smaller businesses don't necessarily know where to start or what the implications of a no-deal might be, and don't have the time, money or resources to deal with it anyway. Many firms will simply find it impossible to plan for a no-deal Brexit, says Nigel Driffield, professor of strategy and international business at Warwick Business School.



Open-source containers move toward high-performance computing

Open-source containers move toward high-performance computing
Until quite recently, the high-performance market with its emphasis on big data and supercomputing, paid little attention to containers. This was largely because the tightly coupled technology model of supercomputing didn't fit well into the loosely coupled microservices world that containers generally serve. There were security concerns, as well, since. For example, Docker applications often bestow root privileges on those running them — an issue that doesn't work very well in the supercomputing world where security is exceedingly important. A significant change came about when Singularity — a container system with a focus on high-performance computing — became available. Now provided by Sylabs, Singularity began as an open-source project at Lawrence Berkeley National Laboratory in 2015. Singularity was born because there was a lot of interest in containers for compute, but the commonly used containers (Docker) at the time did not support compute-focused, HPC-type use cases.


Privacy no more: How machine learning in the cloud will strip us naked

Machine learning is an essential part of the digital transformation trend in the modern enterprise. The ability to gain insight into business processes through what is measurable using different types of sensors, and to correlate that data using pattern analysis, is an increasingly important capability that is quickly becoming an essential part of the overall IT toolbox.  For example, companies like SAP, through Leonardo Intelligent Enterprise products, have brought together IoT along with finished application platforms deployed as cloud-based SaaS, which can be easily customized so that enterprises can create complex data visualizations in order to gain insight when solving complex business problems.  Understanding patterns and trends through big data is nothing new: The National Security Agency has been doing complex signal intelligence (SIGINT) for many years in order to defend the country from terrorist and foreign threats.


What is SWOT analysis? A strategic tool for achieving objectives

What is SWOT analysis? A strategic tool for achieving objectives
SWOT analyses from major corporations can help you get an idea of how the process works. Strategic Management Insight offers examples of SWOT analysesfor a wide range of companies, including Google, Starbucks and Amazon.  Its example SWOT analysis of Microsoft evaluates the potential impact of a major leadership change in the organization — in this case, the hiring of CEO Satya Nadella. SM Insight identifies Microsoft’s strengths as the company’s brand awareness, it’s wide acceptance in the enterprise, easy-to-use products, a worldwide network of distributors and an ability to beat analyst’s expectations. Weaknesses include being late to mobile computing, a lack of urgency when the internet was introduced and security flaws in its software. Cloud computing was seen as a big opportunity for Microsoft at that time, as the organization had the chance to take the lead in this trend, and the company was economically strong. Microsoft’s biggest threats included the company’s size, which can slow progress, as well as a failure to notice emerging trends, piracy and lawsuits.


ThoughtWorks COO reveals his top tech predictions for 2019

Companies will continue to leverage technology to gain efficiencies and cost savings. But replacing jobs with machines leads to a zero-sum game and will only take you so far, given its deleterious impact on society and the economy. At ThoughtWorks, we believe that humans and machines can collaborate and this intelligent co-working is what we call Humanity Augmented. Humanity Augmented makes available intelligent tools to augment human capability; aiding in better and quicker decision making, reducing and eliminating mundane and repetitive tasks and allowing people to spend time unleashing their creativity on more complex and fulfilling work. By bringing together human experience and intuition and the ability of machines to process humongous volumes of data, we will be able to address the short-term job losses and in the long-term tackle long- standing issues that the human race faces.


Tech sector vacancies increase by almost a quarter in 2018


The industry is already concerned that not enough people are choosing to study science, technology, engineering and maths (Stem) to fill the growing digital skills gap, and it is estimated that the UK’s digital economy will need about 2.3 million skilled workers by 2020. Kaiser pointed out that developing technical skills is important, but encouraging more people from different backgrounds into tech could also help to close the skills gap. “Developing technical skills, whether that’s studying computer science or learning new coding languages, can open the door to all kinds of careers, from design to technology marketing to managing a business division,” she said. “Yet too often there is a flawed perception that some groups, such as women or BAME [black, Asian and minority ethnic] individuals, don’t belong in Stem professions.” But breaking down industry stereotypes to encourage people from diverse backgrounds to consider Stem careers is only one way to tackle the looming skills gap.


Step-by-step guide to a blockchain implementation

Banks are under particular pressure to get going on blockchain implementations because they're facing pressure on three fronts, said Jeff Garzik, co-founder at Bloq, a startup focused on helping enterprises build blockchain platforms. Technology companies like Apple and Google are rolling out payment software; telecom companies are enabling consumers to use their mobile phones as a bank account, to pay bills and send money; and cryptocurrencies such as Bitcoin and Ethereum, which are underpinned by blockchain technology, are being used to disrupt banks much the same way tech and telecom companies are. But, he said, the disintermediation to banks will not be all-encompassing. "You're not going to have Aunt Joan and Uncle Joe store all of their wealth on their smartphone, for example. Banks are still going to exist and provide loans and provide services that strictly cashlike Bitcoin and Ethereum systems do not provide."


How to develop a data culture within your organisation


Because data is so pervasive, it reaches beyond people’s professional trades and competences. Everyone has a role in data, either as a data owner, a data process owner or simply as a user. The challenge of developing a data culture is not only to make people comfortable with data, but to make them data-savvy. As an encouraging factor, the CDO who succeeds in this endeavour will find his reward in a job that becomes much more gratifying. This challenge requires the leadership to pay more attention to people’s skills and mandates than to their titles and seniority because a data culture is truly a collaborative culture. Developing a collaborative mindset and acknowledging the dependency on people regardless of pay rate is perhaps the most difficult part of developing a data culture because dependencies can seem frightening. The mission can essentially be boiled down to three actions that are required to develop a data culture and enhance the confidence in the people and processes that make up the data culture


Memes on Twitter Used to Communicate With Malware

What's noteworthy about the new Trojan is its use of the Twitter memes to retrieve malicious instructions, according to Trend Micro, the first to report on the threat. The authors of the malware—currently unknown—posted two tweets featuring the malicious memes in late October using a Twitter account that appears to have been created last year. Embedded in the memes is a /print command that basically instructs the infected computer to take screen shots and perform other malicious functions. The malware extracts the command after first downloading the malicious memes to the infected system. The malware supports a variety of other commands including /processos for retrieving a list of running processes, /clipfor capturing clipboard contents, and /username for grabbing the username from the infected system. The screenshots and other captured data are then sent to a control server whose address the malware obtains via a hard-coded URL on pastebin.com, Trend Micro said in a report on the attack.


McAfee researchers analyze cybercriminal markets, reveal tactics, targets

analyze cybercriminal markets
In an effort to evade law enforcement and build trust directly with customers, some entrepreneurial cybercriminals have shifted away from using larger markets to sell their goods and have begun creating their own specialized shops. This shift has sparked a new line of business for website designers offering to build hidden marketplaces for aspiring shady business owners. “Cybercriminals are very opportunistic in nature,” said John Fokker, head of cybercriminal investigations at McAfee. “The cyberthreats we face today once began as conversations on hidden forums and grew into products and services available on underground markets. Additionally, the strong brands we see emerging offer a lot to cybercriminals: higher infection rates, and both operational and financial security.” Hacker forums provide an elusive space for cybercriminals to discuss cybercrime-related topics with their peers. McAfee researchers witnessed conversations around the following topics in Q3



Quote for the day:


"The signs of outstanding leadership are found among the followers." -- Max DePree


Daily Tech Digest - December 18, 2018


The banking CFO’s future looks promising, but there are barriers to success. Banks have been relatively late adapters of some important new technologies; for example, nearly half (43%) of banks told us they do not have a cloud strategy in place or have only started to implement basic cloud practices. Bank CFOs often need to work around a legacy architecture that hampers access to big data and makes it more difficult to plug in analytics, perform stress-testing and satisfy regulatory demands for high-quality, comprehensive data. The to-do list for banking industry CFOs is a long one – they must demonstrate the benefits of technology in their own functions, recruit data scientists and other needed talent to new roles in finance, and champion innovation throughout the organization. But, as respondents told us, there has never been a more exciting time to work in finance. The digital transformation of banking should position CFOs not only as trusted advisers but as the developers of new sources of value for their organizations.



An Interview with Greg DeArment, Head of Infrastructure at Palantir

Modern applications are developed to run in “containers”, a way of packing applications and necessary dependencies in a portable, standardized format. This makes deploying easier and more repeatable across environments than deploying software directly on bare bones operating systems. Enterprise architects and developers are probably familiar with the container solution Docker, but there are many others and even a standard for containers called OCI for Open Container Initiative (OCI). Whatever the container solution, there is a need for better orchestration and management of the containers. This is where Kubernetes comes in. ... Most open-source compute platforms today, such as Hadoop Yarn, lead to a trade-off between security and robustness of the toolset users have at their disposal to empower their business. With Kubernetes, we can enable Foundry users to work with the tools of their choice without compromising the security posture of the platform and putting at risk the security of our customers’ data. 


What̢۪s Changed? The Gartner 2018 SIEM Magic Quadrant
Gartner readjusts its Magic Quadrant evaluation criteria, usually in response to market changes, each year. Therefore, vendors who appeared in the MQ report one year may not return for the next one. By the same token, vendors who once did not make the cut in a previous report may find themselves on the next iteration.  Gartner’s states in its report that a vendor’s appearance or disappearance from the quadrant is not a reflection of a change in quality or in opinion, but simply a result of market changes and updated inclusion criteria.  LogPoint made the cut for the 2018 SIEM Magic Quadrant, having met all of Gartner’s inclusion criteria. By the same token, three vendors who previously appeared did not meet the inclusion criteria in this year’s report. Gartner excluded Trustwave and FireEye, as both vendors shift focus from SIEM to managed services and platforms. In addition, Micro Focus (NetIQ) Sentinel lost Gartner’s coverage as the vendor focuses on its ArcSight product instead.


Warding off security vulnerabilities with centralized data

Centralizing information also means that no information should be stored on local devices. USB keys are one of the biggest offenders. These devices are often lost or stolen. In late 2017, a USB stick with highly confidential Heathrow Airport security data was found on the street. The drive’s files included detailed airport security and anti-terror measures. Moreover, people tend to use USB keys that they’ve gotten for free from conferences. It’s possible that these devices have been intentionally infected with viruses. A security event in Taiwan recently awarded quiz winners USB sticks that contained malware designed to steal personal information. That’s not all, the list of USB drive-related incidents goes on. There is also the possibility that your phone or laptop will be lost or stolen. Those odds become even greater when you’re traveling or running between meetings, events, and other appointments. If you have all of your files saved directly on your physical laptop or phone, you’re presented with an obvious problem.


Network Innovation or Iteration? – A Matter of Perspective

networkinnovation
Enterprises have taken notice of what the web scale providers, like Amazon, are achieving, and want to duplicate those strategies. The problem is, most companies do not have teams of developers to build custom network infrastructures, nor the resources to support them. In addition, the network traditionally is not included as a key part of the core business plan. Rather, the network is just one of many tools in IT’s toolbox, often deployed ‘out of the box’ and relied upon to perform and support the demands of the business.  So, while they want the same network agility and manageability the web scale companies enjoy, enterprises struggle to achieve agility and performance based on the available iterations of technology presented to them by known vendors. In addition, network innovation presents an exceptional challenge due to the silos created around network roles and the need for IT staff to manage the network. Because of this isolation, it is easier to pass through iterative solutions as new and continue the cycle of inefficiency.


New chip techniques are needed for the new computing workloads

New chip techniques are needed for the new computing workloads
Intel has designed a new approach. Called Foveros, it allows many different chips built with different technology “nodes” and of different functionality to be stacked on top of each other with very fast communications between them. It also has sufficient power and heat transfer to make the resulting device nearly as effective as a monolithic chip. This type of technology has always been attractive, but it’s only now that Intel has found a way to make its performance and cost of manufacture competitive. ... Some would say Intel is moving down this route because it lost its once two- to three-year advantage in process technology to more nimble players (e.g., TSMC). Certainly Intel has much to do to fix its process manufacturing problems. But many future chips will need circuits that don’t always lend themselves to the most modern process (e.g., FPGAs for AI programming, non-volatile memories, Input/Output and communications/5G), nor do well being embedded in massive monolithic system chips.


Does AI Truly Learn And Why We Need to Stop Overhyping Deep Learning


Whether neural network, Naïve Bayes or simply linear regression, data scientists train their machine learning models on carefully constructed piles of training examples then claim their algorithms have “learned” about the world. Yet, machine learning is in reality merely another form of machine instruction, different from purely expert manual coding of rules, but still guided, with the algorithms and workflows manually tuned for each application. Why does this matter? It matters because as we increasingly deploy AI systems into mission critical applications directly affecting human life, from driverless cars to medicine, we must understand their very real limitations and brittleness in order to properly understand their risks. Putting this all together, in the end, as we ascribe our own aspirations to mundane piles of code, anthropomorphizing them into living breathing silicon humans, rather than merely statistical representations of patterns in data, we lose track of their very real limitations and think in terms of utopian hyperbole rather then the very real risk calculus needed to ensure their safe and robust integration into our lives.


How Governments Are Adopting Blockchain and AI In Advanced Economies

How Governments Are Adopting Blockchain and AI In Advanced Economies Part 2
The government of Denmark is looking into the use of AI and the blockchain in digital identity, healthcare, business support and its welfare system. Denmark is one of those countries which have ensured that most of its service provision to citizens is done digitally. Indeed, 90% of Denmark’s governmental services are already being done digitally (Basu, 2017). But the people want more. Danish citizens are demanding even faster response and delivery times for government services. Denmark is also being forced into the blockchain evolution by the country’s population demographics. Denmark’s ageing population means that fewer younger people are available to get into the public service. Therefore, this is a classical case where augmentation of the human workforce using the blockchain and AI is desirable. For Denmark, this has become a necessity, even though it can be quite controversial. Denmark has a welfare system which caters to retirees, vulnerable groups and pensioners.


Brute force and dictionary attacks: A cheat sheet

securityistock-1065755652bluebay2014.jpg
Brute force attacks involves repeated login attempts using every possible letter, number, and character combination to guess a password. An attacker using brute force is typically trying to guess one of three things: A user or an administrator password, a password hash key, or an encryption key. Guessing a short password can be relatively simple, but that isn't necessarily the case for longer password or encryption keys—the difficulty of brute force attacks grows exponentially the longer the password or key is. The most basic form of brute force attack is an exhaustive key search, which is exactly what it sounds like: Trying every single possible password solution (i.e., lowercase letters, capital letters, numbers, and special characters) character by character until a solution is found. Other brute force methods attempt to narrow the field of possible passwords by using a dictionary of terms (which is covered in more detail below), a rainbow table of precomputed password hashes, or rules based on usernames or other characteristics known about the account being targeted.


Practical CIO: Agility, speed, and business alignment

IT leadership is becoming proficient in all aspects of the business, whether it's marketing, whether it's HR, whether it's legal, whether it's advertising, whether it's the medical side. You have to become knowledgeable on how to apply that technology to get those wins and put game changers, from an IT standpoint, into the business so that you get future growth, you get further merger and acquisitions, scalability and flexibility but, at the same time, keeping it easy and simple. Typically, it's through research. It's peers, other CIOs across the industry, in other industries as well and, in my background, I've been in several different verticals within IT and in leadership, so transportation, retail, insurance, and so bringing that background, some of that background, that experience within healthcare. IT is IT, but how you solve those problems, I think you can bring experience and expertise. You can apply those and get wins in other verticals as well.



Quote for the day:


"Increasingly, management's role is not to organize work, but to direct passion and purpose." -- Greg Satell


Daily Tech Digest - December 17, 2018

Dell XPS 13: The best Linux laptop of 2018

The system comes with 16GB of RAM. This isn't plain-Jane RAM. It's fast 2133MHz LPDDR3 RAM. It's backed by a 512GB PCIe solid state drive (SSD). To see how all this hardware would really work for a developer, I ran the Phoronix Test Suite. This is a system benchmark, which focuses primarily on Linux. This system averaged 461.5 seconds to compile the 4.18 Linux kernel. For a laptop, those are darn good numbers. When it comes to graphics, the XPS 13 uses an Intel UHD Graphics 620 chipset. This powers up a 13.3-inch 4K Ultra HD 3840 x 2160 InfinityEdge touch display. This is a lovely screen, but it has two annoyances. First, when you boot-up, the font is tiny. This quickly changes, but it still can lead to a few seconds of screen squinting. The terminal font can also be on the small side. My solution to this was upscaling the display by using Settings > Devices > Displays menu and moving the Scale field from its default 200 percent to a more reasonable -- for me -- 220 percent. Your eyesight may vary.


Using Microsoft Flow to connect Office 365 to Google's GSuite


Flow is an easy way of integrating applications adding basic business logic around a connection. You don't need to have a Flow-specific subscription to use it, as some of its features are available for free. Flow has a long list of available connectors, offering a mix of endpoints in both Microsoft and third-party services. Connectors are available for standard and premium accounts, with some — like Salesforce and ServiceNow — only available to premium subscribers. Luckily that doesn't affect anyone wanting to connect their Office 365 and GSuite services, as Office and Google endpoints are all part of the standard tier. Currently you'll find endpoints for Gmail, Google Calendar, Google Contacts, Google Drive, Google Sheets, and Google Tasks. Similar endpoints exist for matching Office 365 services, so you can map one service into another, with much of the functionality you need handled by triggers in the Office 365 Outlook endpoint.


CIO interview: Alan Talbot, CIO, Air Malta


Talbot says he has also dedicated time and resources to other significant technology projects, including the overhaul of flight operation systems with the introduction of best-of-breed technology from Lufthansa. Talbot also points to an integration project with Ryanair, whereby Air Malta now sells flights from the ryanair.com website.  “That project helped break the barrier when it came to proving the benefits of integration within our business,” he says. “Even the most tech-sceptical could see you can really change operations for the better. There’s a lot of pain and effort behind the scenes, of course, but the organisation is already seeing the benefits of transformation.”  Air Malta currently offers an additional 150 destinations through code-share agreements with a number of airlines. About 80% of all passengers are incoming to Malta, with most arriving for holidays.  The airline carries a sizeable amount of cargo each year, including valuables, perishable consignments, pharmaceuticals and microelectronics, and handles special cargo consignments.


Why data privacy professionals need a new approach to compliance

The first approach is a manual approach to identify and document personal data across your organization’s technology environment. This approach requires a significant amount of time to validate the data inventory and mapping. The second approach is the automated approach using data discovery and scanning tools to develop your data inventory mapping. This approach uses less effort to validate the data inventory and mapping, but could potentially miss shadow IT in your organization. If you take this approach, you may still need to ask the business units if they use any technology solutions that fall outside of the IT environment. Most organizations have already implemented a data retention and disposal policy and a retention schedule. Many organizations have already updated these two documents for GDPR; however, most organizations have difficulty disposing of data, even if they have an updated retention schedule.


Microsoft takes on Google Optimize with Clarity


Microsoft says the Bing team uses Clarity to delve into sessions that saw negative customer satisfaction and determine what went wrong. In a few cases, the team figured out that poor user experience was due to malware installed on the end user’s machine that was hijacking the page and inserting bad content. Clarity requires a small piece of JavaScript added to the HTML webpage (desktop or mobile) so it can listen to browser events and instruments layout changes, network requests, and user interactions. The instrumentation data is then uploaded to the Clarity server running on Microsoft Azure. Over on GitHub, Microsoft has open-sourced the JavaScript library that instruments pages. Session Replay is probably enough to pique a web developer’s curiosity, but Microsoft’s plans for Clarity are even more interesting. Literally called “Interesting sessions,” this feature will use Clarity’s AI and machine learning capabilities to help web developers review user sessions with abnormal click or scroll behavior, session length, JavaScript errors, and so on.


Low-code could change much more than just IT, according to exec

With low-code, the opposite is true: by allowing and encouraging users to help develop the system they need, it is possible not only to get everyone on side but also to maximise value as the original system is tweaked to help individuals at the ‘coal face’ do their job better. This is why the new wave of low-code solutions could truly revolutionise corporate IT, allowing businesses to harness the entrepreneurial spirit of their employees and escape the cycle of cumbersome IT procurement, compatibility issues and legacy systems. Everyone has this spirit – but it’s not always aimed in the right direction. Naturally, workers want to make their job easier, although even these solutions can be ingenious and useful: Think of the bottling plant that installed a state-of-the-art system to detect unfilled plastic bottles making their way into the final crates. When managers went to investigate why the system never sounded the alarm, they found an employee had placed a fan next to the conveyor belt, blowing any empties into a convenient bin, before they reached the new sensors. Why?


Seven Ways Artificial Intelligence Will Impact Future Workplaces


As a cause, AI is resetting how we think about human labour. At this point in time, very few people really know how AI will impact organisations or how quickly AI will replace, modify or destroy jobs. Business leaders are confronted with the challenge of unpredictable future headcounts and traditional rules of thumb for forecasting labour needs are no longer valid. As AI platforms become more sophisticated, they will eventually start managing workflows and job creation in organisations (they already are in some leading organisations). Ultimately, these platforms will be better equipped than humans to understand headcount volatility and predict long-term trends, allowing for smarter real estate strategies. AI will not stop unpredictability – just help us understand and manage it better. So, AI is causing us headcount headaches today, but it will take time before AI steps in to help sort out the problem it has created.


Simplifying Blockchain Security Using Hyperledger Ursa

Ursa’s primary objective is to simplify and consolidate cryptographic libraries in a trusted, consumable manner for use in distributed ledger technology projects in an interoperable way.  Within Project Ursa, a comprehensive library of modular signatures and symmetric-key primitives will be available so developers can swap in and out different cryptographic schemes through configuration and without having to modify their code. In addition to this base library, Ursa will also include newer cryptography, including pairing-based, threshold, and aggregate signatures. In addition to these signatures, zero-knowledge primitives including SNARKs will also be included.  Blockchain security is highly dependent upon cryptographic operations, but for developers, choosing the correct implementation is a challenge.


Can Algorithms Run Things Better Than Humans?


The exponential growth of digital sensors, computational devices, and communication technology is flooding the world with data. To make sense of all this new information, Danaher observes, humans are turning to the impressive capabilities of machine-learning algorithms to facilitate data-driven decision making. "The potential here is vast," he writes. "Algorithmic governance systems could, according to some researchers, be faster, more efficient and less biased than traditional human-led decision-making systems." Danaher analogizes algocracy to epistocracy—that is, rule by the wise. And epistocracy is not too dissimilar from the early 20th century Progressive idea that corruptly partisan democratic governance should be "rationalized," or controlled by efficient bureaucracies staffed with objective and knowledgeable experts. If rule by experts is good, wouldn't rule by impartial, infallible computers be better?


NHS and technology: Making the case for innovation

The NHS has tried to fix this before, with the giant National Programme for IT, which attempted, at massive cost, to build gigantic systems that could work across the entire health service. It failed. Since then there has been something of a backlash against centralised systems, but this in turn has made it hard for the NHS bodies to communicate across boundaries -- something which brings new risks, as Hancock bluntly pointed out: "A world in which we ask an ill patient many times over for their name and address is a problem. A world in which a hospital can't pull up a patient's GP record is downright dangerous. So our systems need to be able to talk to each other." The bigger problem is that, while NHS spending continues to rise, it's still being outpaced by increased demand for services. The population continues to grow, and while we're living longer we're also more likely to have multiple, expensive, long-term conditions for doctors to treat.



Quote for the day:


"When we lead from the heart, we don't need to work on being authentic we just are!" -- Gordon Tredgold